Top 10 winner

Exploiting XXE in File Upload Functionality

Will Vandevanter · Black Hat

Shows how XXE can reach uploaded OOXML documents and XMP metadata in PDFs and image formats. Covers the oxml_xxe tool, document-part parsing, a Java XMP parser example, and testing for entity expansion, XSS, file access and SSRF. Emphasizes that upload parsers may differ from API parsers and require separate configuration checks.

Record

Researcher

Will Vandevanter

Published by

Black Hat

Format

Recording

Topic

Injection

In the archive

• Ranked #7 in the 2015 Top 10 Web Hacking Techniques

Related sources

• Exploiting XXE in File Upload Functionality Slides
• Exploiting XXE Vulnerabilities In File Parsing Functionality

Tags

• xxe
• file-upload
• ssrf
• lfi
• xss
• pdf
• tooling
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Will Vandevanter, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 September 2026.